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REMARKS 




The Examiner has objected to Claims 1, 9, and 17 due to informalities. 
r* *s*y specifically, the Examiner objected to the limitation "have been written to a data storage 
device." Applicant asserts that, after reviewing the claims and specification, such 
limitation is indeed definite, supported by the specification, etc. If the Examiner wishes 
to discuss such issue in more detail, he is invited to contact the undersigned. 



The Examiner has rejected Claims 1-27 under 35 U.S.C. 103(a) as being 
unpatentable over Cozza (U.S. Patent No. 5,502,815) in view of Waldin et al. (U.S. 
Patent No. 6,094,731). Applicant respectfully disagrees with such rejection. 

With respect to each of the independent claims, the Examiner has relied on Col. 3, 
lines 35-40 from Cozza to make a prior art showing of applicant's claimed "storing data 
identifying computer files that have been written to a data storage device and for which a 
scan for malware has yet to be performed." 

Applicant respectfully asserts that such excerpt relates to storing information on 
states of files such that changes in a fork size of the stored information may be utilized 
for determining a subset of viruses to scan for (see Abstract). Clearly, such excerpt does 
not even suggest applicant's claim language where "data [is stored that] identifyfiesl 
computer files that have been written to a data storage device and for which a scan for 
malware has yet to be performed" (emphasis added). 

In the Office Action mailed 03/10/2006, the Examiner argued that "Cozza 
explicitly discloses this information is stored in a cache in a non-volatile storage medium 
and when files are subsequently scanned for viruses (see Abstract)." After again 
reviewing Cozza, it is noted that the Abstract of Cozza discloses that the initial state 
information concerning the file "is stored in a cache in a non-volatile storage medium and 
when files are subsequently scanned for viruses, the current state information is 
compared to the initial state information stored in the cache ." Clearly, storing the initial 
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state information of a file in a cache fails to even suggest "storing data identifying 
computer files that have been written to a data storage device and for which a scan for 
malware has yet to be performed" (emphasis added), as claimed by applicant. 
Applicant's claimed technique requires that the files and data identifying the same are to 
be written and stored, respectively. 

Additionally, the Examiner relied upon Col. 3, lines 45-65 and Col. 6, lines 10-45 
to make a prior art showing of applicant's claimed "scanning code operable as a low 
priority task within a multitasking environment to conduct malware scanning upon 
computer files identified within said pending scan database as haven been written to the 
data storage device and for which the scan for malware has yet to be performed" (see the 
same or similar, but not identical language in each of the independent claims). For 
substantially the same reasons as argued above, applicant respectfully asserts that neither 
Cozza nor Waldin teach "scanning code operable as a low priority task within a 
multitasking environment to conduct malware scanning upon computer files identified . . . 
as haven been written to the data storage device and for which the scan for malware has 
yet to be performed," as presently claimed by applicant. Specifically, applicant asserts 
that the excerpts from Waldin relied upon by the Examiner fail to disclose "a low priority 
task " that operates on computer files identified " as haven been written to the data storage 
device and for which the scan for malware has yet to be performed " (emphasis added), as 
claimed by applicant. 

In the Office Action mailed 03/10/2006, the Examiner argues that 'this argument 
does not make sense because Applicant did not claim this limitation "as haven been 
written to a data storage device and for which a scan for malware has yet to be 
performed" as discussed in the previous Office action.' In response, applicant asserts that 
the claim language is indeed claimed (see previous amendments) and is definite, 
supported, etc. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
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in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.l991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Thus, a notice of 
allowance or specific prior art showing of each of the foregoing claim elements, in 
combination with the remaining claimed features, is respectfully requested. 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. Just by way of example, with respect to Claim 2 et al., the Examiner 
has relied on Col. 2, line 55-Col. 3, line 8 from Cozza to make a prior art showing of 
applicant's claimed "file write code operable as a computer file is written to a storage 
device to add data identifying said computer file to said pending scan database." 

Applicant respectfully asserts that such excerpt only teaches that "information 
detailing the initial 'state' of an uninfected file... can be 'cached'." However, Cozza does 
not teach when such state information is stored, but only that the file must be in an initial 
state. Clearly, only generally teaching storing initial state information of a file, as in 
Cozza, does not meet applicant's specific claim language, namely that " as a computer file 
is written to a storage device .. .data identifying said computer file [is added] to said 
pending scan database" (emphasis added). Furthermore, Cozza only teaches that the state 
information is stored, but not that it is stored to a "pending scan database," as claimed by 
applicant. In fact, Cozza only scans a current state data, which would not require the 
initial state information to be stored in a pending scan database. 
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With respect to Claim 4 et aL, the Examiner has relied on Col. 3, lines 35-40 in 
Cozza to make a prior art showing of applicant's claimed "scanned file database code 
operable to maintain a scanned file database storing data identifying computer files that 
have been scanned for malware." Applicant respectfully asserts that such excerpt only 
teaches storing information on a current state and prior states of a file. When read in 
context, Cozza stores such states for determining what set of viruses to scan the 
associated file for (see Abstract). Thus, Cozza does not teach a "scanned file 
database. . . [for] storing data identifying computer files that have been scanned for 
malware" (emphasis added). 

With respect to Claim 7 et al., the Examiner has relied on Col. 3, lines 35-55 in 
Cozza to make a prior art showing of applicant's claimed "initiation code operable upon 
startup to detect any computer files stored on a storage device not included within either 
said pending scan database or said scanned file database and to add such computer files 
to said pending scan database." 

Applicant respectfully asserts that Cozza only teaches storing states of files and 
using such states to scan each file "stored in a memory system." However, Cozza does 
not specifically teach a "pending scan database" and "scanned file database", let alone 
detecting "upon startup... any computer files stored on a storage device not included 
within either said pending scan database or said scanned file database and. . , add|mg] such 
computer files to said pending scan database, " as claimed by applicant (emphasis added). 

Further, with respect to Claims 25 and 27, the Examiner, in the Office Action 
mailed 03/10/2006, has relied on Col. 3, lines 50-67 and Col. 4, lines 15-60 in Cozza to 
make a prior art showing of applicant's claimed technique "wherein an order of said 
computer files identified within said pending scan database being scanned is based on an 
algorithm that estimates the likelihood of a read request being performed on each 
computer file" (see Claim 25) and "wherein an order of said computer files identified 
within said pending scan database being scanned is based on the order in which said 
computer files were placed in said pending scan database" (see Claim 27). 



Applicant respectfully asserts that the excerpts from Cozza relied upon by the 
Examiner disclose that "[fjor each file on a volume that is to be scanned, the cache is 
searched for the presence of the file's cache information in step 40." However, merely 
searching for the file's cache information simply fails to even suggest any "order of said 
computer files identified within said pending scan database," as claimed by applicant. 
Furthermore, the excerpts from Cozza fail to disclose that the ordering is "based on an 
algorithm that estimates the likelihood of a read request being performed on each 
computer file" or that the ordering is "based on the order in which said computer files 
were placed in said pending scan database," as claimed by applicant. 

Also, with respect to Claim 26, the Examiner, in the Office Action mailed 
03/10/2006, has relied on Col. 4, line 59 to Col. 5, line 7 in Cozza to make a prior art 
showing to applicant's claimed technique "wherein only computer files determined to be 
clean from the malware scanning are stored in the scanned file database." 

Applicant respectfully asserts that the excerpts from Cozza relied upon by the 
Examiner disclose that "[i]f a virus was found , then the scan cache is updated with zeroed 
information for the file in step 60" (emphasis added). However, updating the scan cache 
with zeroed information for a file found to have a virus teaches away from a technique 
"wherein only computer files determined to be clean from the malware scanning are 
stored in the scanned file database " (emphasis added), as claimed by applicant. 



